PT-2005-1035 · Foxtail Technology+6 · Xpdf+9
Infamous41Md
·
Publicado
2005-12-06
·
Atualizado
2018-10-19
·
CVE-2005-3192
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
kdegraphics versions prior to 3.4.3-r3
Xpdf version 3.01
pdftohtml (affected versions not specified)
Description
The issue involves multiple vulnerabilities in the kdegraphics package and pdftohtml, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. A heap-based buffer overflow in the StreamPredictor function in Xpdf, also used in products like Poppler, teTeX, KDE kpdf, pdftohtml, KOffice KWord, CUPS, and libextractor, allows remote attackers to execute arbitrary code via a PDF file with an out-of-range numComps field.
Recommendations
For kdegraphics versions prior to 3.4.3-r3, update to version 3.4.3-r3 or later.
For Xpdf version 3.01, consider disabling the StreamPredictor function until a patch is available.
For pdftohtml, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
RCE
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Cups
Office Word
Kpdf
Poppler
Red Hat
Xpdf
Kdegraphics
Libextractor
Pdftohtml
Tetex